Advanced Administration of the Gnulinux Operating System
Total Page：16
File Type：pdf, Size：1020Kb
Server administration Remo Suppi Boldrito PID_00148466 GNUFDL • PID_00148466 Server administration Copyright © 2009, FUOC. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is included in the section entitled "GNU Free Documentation License" GNUFDL • PID_00148466 Server administration Index Introduction............................................................................................... 5 1. Domain name system (DNS)............................................................ 7 1.1. Cache names server .................................................................... 7 1.2. Forwarders ................................................................................... 10 1.3. Configuration of an own domain .............................................. 11 2. NIS (YP)................................................................................................. 14 2.1. ¿How do we initiate a local NIS client in Debian? ..................... 14 2.2. What resources must be specified in order to use NIS? .............. 15 2.3. How should we execute a master NIS server? ............................ 16 2.4. How should we configure a server? ............................................ 17 3. Remote connection services: telnet and ssh............................... 19 3.1. Telnet and telnetd ....................................................................... 19 3.2. Secure shell or SSH .................................................................... 20 3.2.1. ssh .................................................................................. 20 3.2.2. sshd ................................................................................ 21 3.2.3. Tunnel over SSH ............................................................ 22 4. File transfer services: FTP................................................................ 23 4.1. FTP client (conventional) ........................................................... 23 4.2. FTP servers ................................................................................... 24 5. Information exchange services at user level.............................. 26 5.1. The mail transport agent (MTA) ................................................. 26 5.2. Internet message access protocol (IMAP) ................................... 27 5.2.1. Complementary aspects ................................................ 28 5.3. News ............................................................................................ 31 5.4. World Wide Web (httpd) ............................................................ 32 5.4.1. Manual (minimum) configuration of httpd.conf .......... 32 5.4.2. Apache 2.2 + SSL + PHP + MySQL ................................ 33 6. Proxy Service: Squid......................................................................... 38 6.1. Squid as an http accelerator ....................................................... 38 6.2. Squid as proxy-caching ............................................................... 39 7. OpenLdap (Ldap)................................................................................ 40 7.1. Creating and maintaining the database ..................................... 42 8. File services (NFS)............................................................................... 44 GNUFDL • PID_00148466 Server administration 8.1. Wiki server .................................................................................. 45 Activities...................................................................................................... 47 Bibliography............................................................................................... 48 GNUFDL • PID_00148466 5 Server administration Introduction The interconnection between machines and high-speed communications has meant that the resources that are used can be at a different geographical loca- tion to that of the user. UNIX (and of course GNU/Linux) is probably the best example of this philosophy, because from its beginning, the focus has always been on the sharing of resources and the independence of the 'devices'. This philosophy has been realized in the creation of something that has now be- come very common: the services. A service is a resource (which may or not be universal) that makes it possible to obtain information, share data or simply process information remotely, under certain conditions. Our objective is to analyse the services that make it possible for our network. Generally, within a network, there will be a machine (or various machines, depending on the configuration) that will make it possible to exchange information with all the other elements. These machines are called servers and they contain a set of programs that centralise the information and make it easily accessible. These services help to reduce costs and increase the availability of information, but it should be remembered that a centralised service also involves some disad- vantages, as it can come offline and leave the users without the service. The servers should be designed so that all the servers are mirrored to solve these situations. The services can be classified into two categories: those linking computers to computers or those linking users to computers. In the first case, the services are those needed by other computers, whereas in the second, the services are those required by the users (although there are services that may fall into both categories). In the first category, there are the naming services, such as the domain name system (DNS), the user information service (NISYP), the LDAP information directory or the services for storing in proxies. In the second cate- gory, we have interactive connection and remote execution services (SSH, tel- net), file transfer (FTP), user-level information exchange such as email (MTA, IMAP, POP), news, World Wide Web, Wiki and files (NFS). To demonstrate all the possibilities of GNU/Linux Debian-FC6, we will describe each of these ser- vices with a minimal and operative configuration, but without leaving out the aspects related to security and stability. GNUFDL • PID_00148466 7 Server administration 1. Domain name system (DNS) The function of the DNS service (as we explained in the unit on network ad- ministration) is to translate the machine names (legible and easy to remember for users) into IP addresses or vice-versa. Example When we ask the IP address of pirulo.remix.com is, the server will respond 192.168.0.1 (this process is known as mapping); likewise, when we request an IP address, the service will respond with the name of the machine (known as reverse mapping). The domain name system (DNS) is a tree architecture that avoids du- plicating information and makes any searches easier. For this reason, a single DNS makes no sense unless it is part of the architecture. The application that provides this service is called named, it is included in most GNU/Linux distributions (/usr/sbin/named) and it is part of the package called bind (currently version 9.x) coordinated by the ISC (Internet software consortium). The DNS is simply a database, which means that the people that modify it have to be aware of its structure, as, otherwise, the service will be affected. As a precaution, special care must be taken to save copies of the files to avoid any interruption in the service. The package in Debian comes as bind and bind.doc. [LN01, Deb03c, IET03]. The configurations are similar, as they are FC, but you will have to install bind, bind-utils and caching-nameserver which will be managed by the yum for example. 1.1. Cache names server Firstly, we will configure a DNS server to resolve requests, which will act as a cache for name queries (resolver, caching only server). In other words, the first time, the appropriate server will be consulted because we are starting with a database that contains no information, but all subsequent times, the cache names server will respond, with the corresponding decrease in response times. To configure the cache names server, we need the /etc/bind/named.conf file (in Debian), which has the following (the original comments within the file, indicated with //, have been respected): options { directory "/var/cache/bind"; // query-source address * port 53; // forwarders { // 0.0.0.0; // GNUFDL • PID_00148466 8 Server administration }; auth-nxdomain no; # conform to RFC1035 }; // prime the server with knowledge of the root servers} zone "." { type hint; file "/etc/bind/db.root"; }; // be authoritative for the localhost forward and reverse zones, and for // broadcast zones as per RFC 1912 } zone "localhost" { type master; file "/etc/bind/db.local"; }; zone "127.in-addr.arpa" { type master; file "/etc/bind/db.127"; }; zone "0.in-addr.arpa" { type master; file "/etc/bind/db.0"; }; zone "255.in-addr.arpa" { type master; file "/etc/bind/db.255"; }; // add entries for other zones below here } The directory sentence indicates where we will find the remaining configura- tion files (/var/cache/bind in our case). The /etc/bind/db.root file will contain something similar to the following (only the first lines, which are not com- ments indicated by a ';', are shown, and care must be taken with the dots [.]) at the beginning of some lines –they can be obtained and updated directly from the Internet–): ... ;